CVE-2026-111243
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 10, 2026
Vendor
unknown
Description
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.